Introduction
The version used in the project SpringBoot 2.7.4, and the corresponding Spring Security is version 5.7.3, and there are certain changes in the process of using Spring Security.
The first is the configuration method, which we will inherit before WebSecurityConfigurerAdapter, but in the new version, the configuration is directly declared in the form of an interface. The rest of the configuration is similar. Of course, many new methods have been added, but the familiar configuration method can also be used.
Here I mainly talk about withObjectPostProcessorthe problems I encountered when I was using it due to my handicap. I http.authorizeRequests()wrote the configuration http.authorizeHttpRequest(). Because the methods that can be configured in their code prompts are basically the same, I have not found it. I finally saw this when I re-typed the configuration file. Then I went to the official website to find their differences. For specific differences, you can check the official [Original Introduction] . Let me talk about it here in general. Generally speaking, authorizeHttpRequestit is the configuration method that the official will mainly recommend in future versions. It authorizeRequestshas the following points for improvement:
- Use a simplified AuthorizationManager API instead of metadata sources, configuration properties, decision managers and voters. This simplifies reuse and customization.
- Delayed authentication lookups. Instead of needing to look up authentication for every request, it will only look for it in requests where authentication is required for authorization decisions. (This is still relatively good, sometimes not every request needs to be verified in the application)
- Bean-based configuration support.
When using authorizeHttpRequests instead of authorizeRequests, use AuthorizationFilter instead of FilterSecurityInterceptor.
Step on the pit reminder
If you use it authorizeHttpRequests, withObjectPostProcessorit is invalid to use it to configure our custom metadata source and permission decision configuration, because it will not go in. I am curious why since this has such a big pit in use, the official has left this for it The method may be that I don’t know how to use it, but authorizeHttpRequestsall the configurations can be used normally after I changed it.